CVE-2026-66420

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-66420

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66420.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-66420

Published

2026-07-30T21:52:28Z

Modified

2026-09-11T03:31:02Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deployments

Details

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. Attackers can open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-346"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66420.json"
}

References

Affected packages

Git / github.com/ylianst/meshcentral

Affected ranges

Type

GIT

Repo

https://github.com/ylianst/meshcentral

Events

Introduced

3e04e4d8c674707a94d68192987b2e1230a27218

Fixed

f04c9f4

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.1.21"
        },
        {
            "last_affected": "1.1.21"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.1.21

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66420.json"